What Do Redaction Placeholders Like <private_address> Mean?
If a ChatGPT transcript, log, or AI tool shows <private_address>, <private_email>, or <private_person>, something already protected that text for you. Here is exactly what each placeholder stands for, where it comes from, and how redaction is done well.
A redaction placeholder is a typed label that an automated privacy tool drops in place of sensitive information it removed before the text reached an AI model or a log. Tokens like <private_date>, <private_email>, and <private_person> come from OpenAI's Privacy Filter, which sorts each sensitive span into one of eight categories and substitutes the category name so the surrounding text still reads naturally.
The <private_*> placeholders, decoded
These eight tokens are the complete set produced by OpenAI's Privacy Filter. Whenever it finds one of these kinds of sensitive data, it removes the value and leaves the matching label behind. The example column shows the sort of value each one replaced.
| Placeholder | What it replaced | Example value |
|---|---|---|
<private_person> | A person's name (often described as a redacted name) | Sarah Chen |
<private_email> | An email address | sarah.chen@northpoint.io |
<private_phone> | A phone number | (415) 555-0132 |
<private_address> | A postal or street address | 1600 Cedar Ave, Boston |
<private_url> | A URL or link tied to a person | linkedin.com/in/sarahchen |
<private_date> | A date tied to a person (birth date, appointment, hire date) | March 14, 1989 |
<account_number> | An account, card, or identifier number | 4111 1111 1111 1111 |
<secret> | A credential or secret (API key, password, token) | sk-live-9f2a3c... |
Note: <account_number> and <secret> are the two categories that drop the private_ prefix.
Where these placeholders come from
The angle-bracket, lowercase <private_*> style is the signature of OpenAI's Privacy Filter, an open-weight model OpenAI released for detecting and removing personally identifiable information in text. You will most often run into these tokens in ChatGPT-based apps and other tools that run the filter over content before they log it, store it, or show it to you.
Under the hood, the filter does not blindly match patterns. It reads the text and classifies each sensitive span into one of its eight categories (the ones in the table above). An application then replaces each detected span with the category name wrapped in angle brackets, which is why <private_email> appears where an address used to be. The model is small enough to run locally, so PII can be masked without the raw text leaving the machine, and it is released under a permissive open-source license.
One important limit, stated plainly by OpenAI: Privacy Filter is a redaction and data minimization aid, not an anonymization, compliance, or safety guarantee. It only catches spans that match its trained categories, and its accuracy can drop on non-English text. So a placeholder is evidence that a value was caught, not proof that every sensitive value in the document was.
Other placeholder styles you might see
The <private_*> set is one convention among several. If your placeholder looks different, it most likely came from one of these. The bracket style and casing are usually enough to tell which tool produced it.
| Style | Example tokens | Typically produced by |
|---|---|---|
| Generic blackout | [REDACTED], █████ | Manual redaction, legal filings, many DLP tools |
| Typed infoType name (often bracketed) | [EMAIL_ADDRESS], [PERSON_NAME], [DATE] | Google Cloud Sensitive Data Protection (DLP) |
| Typed, angle brackets, uppercase | <PERSON>, <EMAIL_ADDRESS>, <PHONE_NUMBER> | Microsoft Presidio (open source) |
| Typed, angle brackets, lowercase | <private_email>, <private_date> | OpenAI Privacy Filter |
| Structure-preserving, indexed | [PERSON_1], [SSN_a4f2], [DATE_2024-03-15] | PortEden (re-hydratable for authorized users) |
Exact wrappers vary by tool, version, and configuration. Google's service, for example, substitutes the infoType name and the brackets are a common convention rather than a fixed output. The casing and bracket style are the tell, not a standard.
Why a typed placeholder beats a plain blackout
It would be simpler to replace everything sensitive with one [REDACTED]. Typed placeholders exist because the type carries useful signal at almost no privacy cost. Compare the two:
- One generic token: "Email [REDACTED] about the [REDACTED] invoice due [REDACTED]." A model can barely tell what happened here.
- Typed placeholders: "Email
<private_person>about the<account_number>invoice due<private_date>." The structure is intact, so the model can still summarize, classify, or route the message.
That is the whole point of redaction for AI: keep enough structure for the model to be useful, while the underlying values never reach it. The trade-off is that typed placeholders reveal the kind of data that was present, which is almost always an acceptable price for keeping the text usable.
If an AI assistant produced the redaction, that model already received the original text to generate its answer. A placeholder in the output only cleans up what is shown or stored afterward. Redaction after the fact cannot un-send what the model saw. To keep a value away from a model, you have to remove or block it before the request reaches the model, at egress from your systems. That is the difference between hiding data in the transcript and never sending it at all.
Redaction at the boundary, with a way back
The <private_*> tokens you see are redaction working inside one app's output, after the fact, and they are one-way. PortEden applies the same idea earlier and across every connected tool. It is the data firewall for AI: it strips sensitive values at egress, on the boundary between your systems and the model, so the AI vendor never receives raw PII in the first place. And unlike a throwaway <private_email>, it can put the real values back for the right person afterward.
A classifier scans every field bound for the AI: 50+ identifier types and 120+ secret patterns, from SSN and PHI to credit cards, IBANs, JWTs, and cloud keys. Median latency is under 40 ms on an email-sized payload, fast enough to sit inline on every call.
Sensitive values are replaced with structure-preserving placeholders such as [PERSON_1], [SSN_a4f2], and [DATE_2024-03-15], so the model keeps the signal it needs. Originals go into a short-lived, encrypted vault (default 5-minute TTL).
When the model's reply comes back referencing the placeholders, PortEden swaps them for real values in the user's browser. The model never sees the originals; the user never sees the placeholders; every redaction event is recorded in the audit log.
Patient John Rivera, DOB March 14 1989, MRN 88213, asked Dr. Sarah Chen (sarah.chen@northpoint.io) about his April 9 appointment.
Patient [PERSON_1], DOB [DATE_1], MRN [MRN_1], asked [PERSON_2] ([EMAIL_1]) about his [DATE_2] appointment.
The reply comes back referencing [PERSON_1] and [DATE_2], and PortEden restores the real names and dates in the user's view. Policy can be scoped per integration, per user, and per AI client, and the approach maps to HIPAA §164.514(b) Safe Harbor de-identification as a redaction control.
- A redaction placeholder marks where a sensitive value was removed before text reached a model or a log.
- The <private_*> tokens come from OpenAI's Privacy Filter and cover eight categories of personal data.
- From the placeholder alone, the original value cannot be recovered; tokens like <private_email> are one-way.
- Typed placeholders keep text usable for AI; a single [REDACTED] would destroy that structure.
- If an AI assistant generated the redaction, it already received the original; only redaction before the model, at egress, keeps a value out.
- PortEden redacts at egress and can re-hydrate placeholders for authorized users from a short-lived vault.
Frequently asked questions
What does <private_date> mean in a ChatGPT transcript?
It marks a date that a privacy filter treated as personal, such as a birth date, appointment, or any date tied to an individual, and removed before the text was shown or logged. The original date is gone from that text; <private_date> is only a label noting that a date used to be there. It comes from OpenAI's Privacy Filter, which many ChatGPT-based apps run over content before display.
What does <private_address> mean?
A postal or street address was detected and stripped out, then replaced with the <private_address> label so the sentence still makes sense without exposing where someone lives or works. The address itself is not stored inside the placeholder.
What does <private_email> mean?
An email address was removed and replaced with the <private_email> placeholder. The reader (or model) can tell an email belonged there, but the actual address is no longer in the text.
What does <private_phone> mean?
A phone number was detected as personal data and swapped for <private_phone>. As with the other tokens, the number is not recoverable from the placeholder alone.
What does <account_number> mean?
An account, card, or identifier number (bank account, credit card, or member ID) was removed and replaced with <account_number>. Unlike most of the tokens it has no private_ prefix, because it is one of two OpenAI Privacy Filter categories, alongside <secret>, that drop the prefix.
What does <private_person> mean, and why is a name redacted?
A person's name was detected and replaced with <private_person>, which is why you may see it described as a redacted name. Names are personal data, so a privacy filter removes them before content reaches a model or a stored log, while keeping the placeholder so the surrounding text stays coherent.
Can I recover the original value from a redaction placeholder?
Not from the placeholder by itself. Tools like OpenAI's Privacy Filter discard the original, so <private_email> is one-way. Enterprise systems that keep a short-lived, access-controlled vault can re-hydrate placeholders for authorized users, but that mapping lives outside the text, never inside the token.
Does a redaction placeholder mean the AI never saw my data?
Not necessarily. If an AI assistant produced the redaction, the model already received the original text to generate that output, so the placeholder only cleans up what is shown or logged afterward. Redaction after the fact cannot un-send what the model saw. The only way to keep a value from a model is to remove or block it before the request reaches that model, at egress from your systems.
Why use a typed placeholder like <private_date> instead of [REDACTED]?
Because the type keeps the text readable and machine-usable. A model reading 'your <private_date> appointment' still understands a date belonged there, so summaries, routing, and grammar survive. A single [REDACTED] for everything erases that structure and makes the result harder to use.
Keep exploring
PortEden is a software provider, not a law firm, accounting firm, or compliance auditor, and nothing on this page is legal, compliance, tax, or other professional advice. PortEden does not issue compliance certifications, attestations, or audit opinions. This content is provided for general informational purposes only, on an as-is basis and without warranties of any kind, and may not reflect the most current laws, regulations, or your specific situation. Before acting on it, consult a qualified attorney, auditor, or compliance professional.